mirror of
https://github.com/morluto/rea.git
synced 2026-10-28 10:25:42 +00:00
morluto
4fbc501121
* fix(hopper): normalize string-backed addresses and update verification * feat(native): add inspection primitives, dispatch traces and approved UI observation * test: prioritize real artifact E2E and captured golden regressions * fix(process): queue observed output before reactive rendering actions * test: prune redundant cases and strengthen boundary assertions * fix(cli): route native value tracing through shared workflows * test: replace synthetic success with real workflows and captured data * fix(catalog): separate portable metadata from native host availability
40 lines
1.2 KiB
TypeScript
40 lines
1.2 KiB
TypeScript
import { readFile } from "node:fs/promises";
|
|
import { expect, it } from "vitest";
|
|
import { parse } from "yaml";
|
|
import { z } from "zod";
|
|
|
|
// Publishing is irreversible. Keep the release authority invariant as a static
|
|
// boundary check; it is not proof that package installation or publishing works.
|
|
it("requires package verification before publishing and retains the registry canary", async () => {
|
|
const workflow = z
|
|
.object({
|
|
jobs: z.object({
|
|
publish: z.object({
|
|
steps: z.array(z.object({ run: z.string().optional() })),
|
|
}),
|
|
}),
|
|
})
|
|
.parse(
|
|
parse(
|
|
await readFile(
|
|
new URL("../../../.github/workflows/release.yml", import.meta.url),
|
|
"utf8",
|
|
),
|
|
),
|
|
);
|
|
const commands = workflow.jobs.publish.steps.map(({ run }) => run ?? "");
|
|
const verify = commands.findIndex((command) =>
|
|
command.includes("npm run verify:package"),
|
|
);
|
|
const publish = commands.findIndex((command) =>
|
|
command.includes("npm publish"),
|
|
);
|
|
expect(verify).toBeGreaterThanOrEqual(0);
|
|
expect(publish).toBeGreaterThan(verify);
|
|
expect(
|
|
commands
|
|
.slice(publish + 1)
|
|
.some((command) => command.includes("verify-published-package.mjs")),
|
|
).toBe(true);
|
|
});
|